{
 "id": "WPSEC-2026-1932",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1932/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1932/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1932/index.md",
 "title": "Kirki <= 6.4.0 - Authenticated (Author+) Missing Authorization to Arbitrary Page Modification and Unpublished Content Access",
 "description": "The Kirki plugin for WordPress is vulnerable to unauthorized modification and access of data via the page, popup and symbol editor APIs in all versions up to, and including, 6.4.0, due to missing per-post capability checks (edit_post, read_post) in the page and popup REST endpoints, which only verified that the target post existed, and to the symbol update AJAX action accepting any post ID instead of only symbols. Authors have Kirki builder content access by default. This makes it possible for authenticated attackers with author-level access and above to overwrite the builder content of arbitrary pages and posts belonging to other users, change their title, slug and status, modify popups, and read the unpublished staged builder content and version lists of other users' pages.",
 "plugin": {
  "slug": "kirki",
  "name": "Kirki",
  "full_name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "wordpress_org": "https://wordpress.org/plugins/kirki/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kirki/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kirki"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.6,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.3.2",
    "from_inclusive": true,
    "to": "6.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.3.2 before 6.4.1"
  ]
 },
 "introduced_in": "6.3.2",
 "fixed_in": "6.4.1",
 "remediation": "Update to 6.4.1 or later.",
 "fix_released": "2026-10-28T08:36:24+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:40.304666+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1932/",
  "https://plugins.svn.wordpress.org/kirki/tags/6.4.1/",
  "https://wordpress.org/plugins/kirki/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kirki",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}